OneDrive Pastejacking (Campaign) – Malware

Overview

In recent weeks, cybersecurity experts have observed a troubling trend known as OneDrive pastejacking, a sophisticated phishing tactic specifically targeting Microsoft OneDrive users. This emerging threat exploits social engineering techniques to manipulate users into executing harmful PowerShell scripts, potentially compromising their systems. By masquerading as a legitimate need to address a technical issue, attackers effectively lure victims into a trap where their actions lead to the unintentional download of malicious software. The term “pastejacking” itself denotes the clever method employed by cybercriminals to exploit the clipboard functionality within a user’s operating system, using it to execute harmful commands without the user’s awareness.

At the heart of a OneDrive pastejacking attack is an email containing a deceptive HTML attachment that simulates a OneDrive interface. When opened, this file displays an error message that seems to indicate a problem accessing a document stored in the cloud. The message often instructs users to perform actions to resolve a supposed DNS issue, cleverly designed to create a sense of urgency. By preying on the user’s immediate desire to regain access to important files, attackers increase the likelihood of their success. This form of manipulation underscores a growing trend in cyberattacks, where emotional triggers are utilized to prompt hasty actions that ultimately compromise security.

Targets

Individuals

Information

How they operate

Campaign Initiation and Phishing Email

The attack begins with the delivery of a phishing email that serves as the initial bait. Victims receive a message containing an HTML file, which, when opened, reveals a deceptive interface designed to mimic Microsoft OneDrive. This interface displays a false error message, such as “Error 0x8004de86,” claiming that the user must resolve a DNS issue to access a specific document. This tactic capitalizes on the user’s trust in OneDrive and creates an urgency to address the fictitious error promptly.

The Role of the HTML File

Once the HTML file is opened, it executes a series of JavaScript functions that guide the user through the next steps. The file features two buttons: “Details” and “How to fix.” Clicking the “Details” button directs users to a legitimate Microsoft support page, which reinforces the illusion of authenticity. Conversely, the “How to fix” button triggers a JavaScript function (referred to as GD), leading users to a set of instructions that appear to provide a solution to the supposed DNS problem.

Malicious PowerShell Command Execution

At this juncture, the function GD employs the atob() method to decode a Base64-encoded string that contains a malicious PowerShell command. This command is then copied to the user’s clipboard, allowing the malware to instruct victims to paste and execute the command in their PowerShell terminal. The command, once executed, initiates a series of actions: it first runs ipconfig /flushdns to clear the DNS cache, followed by the creation of a “downloads” folder on the C: drive.

Once the folder is established, the malware proceeds to download a zip file containing further payloads into this directory. It then renames the downloaded file and extracts its contents, which typically include an AutoIt script (script.a3x) and the AutoIt executable (AutoIt3.exe). Finally, the script is executed using the AutoIt interpreter, completing the infection process.

Implications of the Attack

The implications of the OneDrive pastejacking campaign are significant, particularly within enterprise environments. By preying on users’ trust and emotional responses, attackers can bypass many traditional security measures that rely on user awareness. The success of this campaign demonstrates the potential for widespread network compromise, unauthorized access to sensitive data, and extensive financial losses resulting from successful infections.

The Importance of Awareness and Prevention

Given the insidious nature of the OneDrive pastejacking campaign, organizations must prioritize robust cybersecurity measures and employee training programs. Users should be educated on recognizing phishing attempts and the importance of scrutinizing unexpected communications, especially those that prompt urgent actions. Additionally, implementing multi-factor authentication and advanced threat detection solutions can further bolster defenses against such sophisticated attacks.

References:

• OneDrive Pastejacking: The crafty phishing and downloader campaign